EUVD-2026-34723
GHSA-4q83-9x32-m447
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconHost crafted HTML page
-
DeliveryLure user to visit (phishing/malvertising)
-
ExploitTrigger TabStrip use-after-free
-
InstallHeap-spray to reclaim freed object
-
C2Gain code execution in renderer
-
ExecuteChain sandbox escape (out of scope)
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must run Chrome at a version below 149.0.7827.53 and actively browse to attacker-controlled HTML (UI:R in the CVSS vector); no authentication to the target or to Chrome is required (PR:N). Exploitation is limited by required user interaction, the Chrome renderer sandbox (a successful UAF yields renderer-level code execution only - host compromise needs a separate sandbox escape), and the reliability of heap grooming for the freed TabStrip object, which Chromium's Low severity rating implies is non-trivial. Chrome's automatic update mechanism rapidly shrinks the exposed population once 149.0.7827.53 ships. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H produces 8.8 (High), indicating network-reachable exploitation with low complexity but requiring user interaction (visiting a malicious page) and no privileges. The Chromium security team independently classified the issue as Low severity, which typically signals that practical exploitation is constrained - likely by sandboxing, mitigations, or reliability of the heap grooming. EPSS data was not supplied for this CVE, and the vulnerability does not appear in CISA KEV, with no public exploit identified at time of analysis. The disparity between the 8.8 CVSS and Chromium's Low rating suggests this is a theoretically high-impact bug that is not currently a priority target - patch on the normal Chrome update cadence rather than as an emergency, but do not defer indefinitely. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that triggers a specific sequence of tab operations (open/close/navigate) designed to dereference a freed TabStrip object after heap reallocation with controlled data, and lures a Chrome user to the page via phishing, malvertising, or a compromised site. The freed-object reclaim yields a memory corruption primitive in the renderer, leading to arbitrary code execution within the renderer sandbox; full system compromise would additionally require a chained sandbox escape. No public proof-of-concept is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the TabStrip component, enabling a remote attacker who lures a victim to a crafted HTML page to corrupt memory and execute arbitrary code within the renderer context. Google rates the underlying Chromium severity as Low, but the CVSS base score of 8.8 reflects the potential impact when chained with a sandbox escape. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - update via the Stable channel auto-updater or by visiting chrome://settings/help and relaunching, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via group policy should push the 149.0.7827.53 (or later) MSI/PKG bundles and force a relaunch within the standard 72-hour patch window. No vendor-supplied workaround exists; as compensating controls until patching completes, restrict browsing of untrusted sites through enterprise web filtering or isolation (browser isolation services / RBI), and enable Site Isolation (default in modern Chrome) to keep cross-origin renderer compromise contained - note that isolation adds memory overhead per process. Downstream Chromium browsers must apply their vendor's equivalent update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TabStrip is the Chrome UI component that manages browser tab state, lifecycle, and rendering within the browser process boundary. CWE-416 (Use After Free) means an object reference is retained and dereferenced after the underlying memory has been freed, typically due to mismanaged lifetimes during asynchronous tab events or DOM-driven state transitions. Attacker-controlled HTML/JavaScript can groom the heap to reclaim the freed allocation with controlled data, converting the dangling pointer into a type confusion or arbitrary read/write primitive that leads to code execution in the renderer process. Chromium UAFs in UI-adjacent components historically require a separate sandbox escape to reach full host compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability in the TabStrip component that can be triggered when employees visit specially crafted websites. No public exploit code has been identified, but successful exploitation would allow attackers to compromise employee browsers and potentially access sensitive corporate data or distribute malware throughout the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB